Ethical Hacking Denial-of-Service (DoS) Attacks Flashcards

24 sample cards from the Denial-of-Service (DoS) Attacks deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is LOIC's "Hive Mind" mode?

   A voluntary botnet feature that lets a user connect their LOIC client to an IRC channel so a coordinator can direct all connected clients to attack the same target simultaneously, aggregating their firepower.

2. What does HOIC stand for and how does it improve on LOIC?

   High Orbit Ion Cannon: a DoS tool that succeeds LOIC. It focuses on HTTP flooding, can attack up to 256 URLs at once, and uses customizable "booster" scripts to randomize headers/user-agents, making traffic harder to filter.

3. What are HOIC "booster" scripts?

   Configurable script files (.hoic) that randomize HTTP request attributes such as user-agent strings, referrers, and target URL paths, helping evade signature-based filtering and increasing attack effectiveness against Layer 7 targets.

4. Compare LOIC and HOIC in one sentence.

   LOIC is an older tool offering TCP/UDP/HTTP floods against a single target with no anonymity, while HOIC is a more powerful HTTP-focused successor that hits multiple URLs and uses booster scripts to randomize/obfuscate requests.

5. What is a Slowloris attack?

   A Layer 7 low-bandwidth DoS attack that opens many connections to a web server and keeps each alive by sending partial HTTP headers very slowly, never completing a request, thereby exhausting the server's connection pool.

6. Why is Slowloris called a "low and slow" attack?

   It uses minimal bandwidth and very few packets, sending data slowly to hold connections open. This lets a single machine take down a server while blending in with normal-looking (just slow) traffic, evading volume-based detection.

7. Which types of web servers are most vulnerable to Slowloris, and why?

   Thread/connection-per-request servers like Apache (with default MPM) are vulnerable because each open connection ties up a worker thread. Event-driven servers like Nginx handle many idle connections efficiently and resist it better.

8. Name three defenses against a Slowloris attack.

   1) Limit connections per source IP and set aggressive connection/header timeouts, 2) increase max allowed connections, and 3) use a reverse proxy/load balancer (e.g., Nginx, HAProxy) or WAF that buffers complete requests before forwarding.

9. How does Slowloris differ from a volumetric HTTP flood?

   An HTTP flood sends a huge volume of complete requests to exhaust bandwidth/CPU, whereas Slowloris sends very little data slowly to exhaust the connection pool. Slowloris is stealthy and low-bandwidth; a flood is high-volume.

10. What is traffic analysis in the context of DoS detection?

    The process of monitoring and inspecting network traffic patterns (volume, packet rates, protocols, source distribution, request types) to distinguish malicious attack traffic from legitimate user traffic and detect anomalies indicating an attack.

11. What is baselining and why is it important for DoS detection?

    Baselining establishes a profile of normal traffic behavior (typical bandwidth, request rates, geographic sources). DoS detection then flags statistically significant deviations from this baseline as potential attacks, reducing reliance on fixed signatures.

12. Name three traffic indicators that suggest a DoS/DDoS attack is underway.

    1) A sudden, large spike in traffic volume or request rate, 2) many requests from a single IP or a narrow range/geography, and 3) traffic from devices sharing a suspicious profile (same user-agent, device type, or malformed requests).

13. What is NetFlow (or sFlow) and how does it aid DoS traffic analysis?

    Flow-export protocols that summarize network traffic into records (source/destination IP, ports, protocol, byte/packet counts). They let defenders analyze traffic composition and volume in near real time to spot attack flows without inspecting every packet.

14. What is rate limiting?

    A defense mechanism that caps the number of requests a client (by IP, API key, or session) may make within a given time window, throttling or dropping excess requests to protect a resource from being overwhelmed.

15. What is the token bucket algorithm for rate limiting?

    Tokens are added to a bucket at a fixed rate $r$ up to capacity $b$. Each request consumes a token; if the bucket is empty, the request is throttled/dropped. It permits bursts up to $b$ while enforcing an average rate $r$.

16. How does the leaky bucket rate-limiting algorithm work?

    Requests enter a queue (bucket) and are processed (leak out) at a constant fixed rate. If requests arrive faster than the leak rate and the bucket overflows, excess requests are dropped, smoothing bursty traffic into a steady output rate.

17. Contrast the token bucket and leaky bucket algorithms.

    Token bucket allows short bursts (up to the bucket size) while limiting the average rate, producing bursty output. Leaky bucket enforces a strictly constant output rate and smooths bursts, but does not allow them to pass through.

18. What is a key limitation of simple per-IP rate limiting against DDoS?

    In a distributed attack, each of thousands of botnet IPs may stay under the per-IP threshold, so no single source trips the limit. IP spoofing and NAT (many users behind one IP) also reduce its effectiveness.

19. What is the fixed-window vs sliding-window distinction in rate limiting?

    Fixed-window counts requests per discrete interval (e.g., per minute), but allows bursts at window boundaries (up to $2\times$ the limit). Sliding-window tracks requests over a rolling time span for smoother, more accurate enforcement.

20. What is a DoS mitigation service?

    A specialized (often cloud-based) service that detects and filters malicious DDoS traffic before it reaches the customer's infrastructure, absorbing large attacks with high-capacity, globally distributed scrubbing centers. Examples: Cloudflare, Akamai, AWS Shield.

21. What is traffic "scrubbing" in DDoS mitigation?

    Redirecting incoming traffic through a scrubbing center that inspects it, removes malicious/attack packets, and forwards only clean, legitimate traffic to the origin server, keeping the service available during an attack.

22. How does Anycast routing help absorb DDoS attacks?

    Anycast advertises one IP address from many geographically distributed data centers. Attack traffic is automatically routed to the nearest node and thus spread across the entire network, diluting the load so no single location is overwhelmed.

23. What role does a Web Application Firewall (WAF) play in DoS mitigation?

    A WAF inspects Layer 7 (HTTP/HTTPS) traffic and blocks malicious requests using rules, rate limits, and behavioral analysis. It defends against application-layer attacks (e.g., HTTP floods, Slowloris) that volumetric network filters miss.

24. What is blackholing (null routing) and its main drawback as a DoS response?

    Blackholing routes all traffic destined for the attacked IP to a null route, dropping everything. It stops the attack from affecting other systems but also drops legitimate traffic, so it completes the denial of service for that target.

What this deck covers

Denial-of-Service (DoS) Attacks flashcards FAQ